66 static void DetectDnsQueryRegisterTests(
void);
68 static int g_dns_query_buffer_id = 0;
90 if (SCDnsTxGetQueryName(cbdata->
txv,
false, cbdata->
local_id, &data, &data_len) == 0) {
102 void *alstate,
void *txv, uint64_t tx_id)
104 uint32_t local_id = 0;
114 DnsQueryGetData(det_ctx, transforms, f, &cbdata, engine->
sm_list);
115 if (buffer == NULL || buffer->
inspect == NULL)
149 const int list_id = ctx->
list_id;
151 uint32_t local_id = 0;
170 static void PrefilterMpmDnsQueryFree(
void *ptr)
186 mpm_reg->
app_v2.alproto, mpm_reg->
app_v2.tx_min_progress,
187 pectx, PrefilterMpmDnsQueryFree, mpm_reg->
pname);
213 "dns request query");
258 static int DetectDnsQueryTest01(
void)
261 uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
262 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
263 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
264 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
265 0x00, 0x10, 0x00, 0x01, };
267 void *dns_state = NULL;
275 memset(&f, 0,
sizeof(
Flow));
278 "192.168.1.5",
"192.168.1.1",
283 f.
proto = IPPROTO_UDP;
297 "(msg:\"Test dns_query option\"; "
298 "dns_query; content:\"google\"; nocase; sid:1;)");
305 STREAM_TOSERVER, buf,
sizeof(buf));
307 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
318 printf(
"sig 1 didn't alert, but it should have: ");
337 static int DetectDnsQueryTest02(
void)
340 uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
341 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
342 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
343 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
344 0x00, 0x01, 0x00, 0x01, };
346 uint8_t buf2[] = { 0x10, 0x32,
350 0x00, 0x00, 0x00, 0x00,
352 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
353 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
354 0x00, 0x01, 0x00, 0x01,
357 0x00, 0x01, 0x00, 0x01,
358 0x00, 0x01, 0x40, 0xef,
360 0x01, 0x02, 0x03, 0x04 };
363 uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
364 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
365 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
366 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
367 0x00, 0x10, 0x00, 0x01, };
369 void *dns_state = NULL;
370 Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
377 memset(&f, 0,
sizeof(
Flow));
380 "192.168.1.5",
"192.168.1.1",
383 "192.168.1.5",
"192.168.1.1",
386 "192.168.1.5",
"192.168.1.1",
391 f.
proto = IPPROTO_UDP;
416 "(msg:\"Test dns_query option\"; "
417 "dns_query; content:\"google.com\"; nocase; sid:1;)");
420 "(msg:\"Test dns_query option\"; "
421 "dns_query; content:\"google.net\"; nocase; sid:2;)");
428 STREAM_TOSERVER, buf1,
sizeof(buf1));
430 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
441 printf(
"(p1) sig 1 didn't alert, but it should have: ");
445 printf(
"(p1) sig 2 did alert, but it should not have: ");
452 printf(
"toserver client 1 returned %" PRId32
", expected 0: ", r);
460 printf(
"(p2) sig 1 alerted, but it should not have: ");
464 printf(
"(p2) sig 2 alerted, but it should not have: ");
471 printf(
"toserver chunk 3 returned %" PRId32
", expected 0: ", r);
479 printf(
"(p3) sig 1 alerted, but it should not have: ");
483 printf(
"(p3) sig 2 didn't alert, but it should have: ");
504 static int DetectDnsQueryTest03(
void)
507 uint8_t buf[] = { 0x00, 28,
508 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
509 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
510 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
511 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
512 0x00, 0x10, 0x00, 0x01, };
514 void *dns_state = NULL;
523 memset(&f, 0,
sizeof(
Flow));
527 "192.168.1.5",
"192.168.1.1",
533 f.
proto = IPPROTO_TCP;
549 "(msg:\"Test dns_query option\"; "
550 "dns_query; content:\"google\"; nocase; sid:1;)");
557 STREAM_TOSERVER, buf,
sizeof(buf));
559 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
570 printf(
"sig 1 didn't alert, but it should have: ");
591 static int DetectDnsQueryTest04(
void)
594 uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
595 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
596 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
597 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
598 0x00, 0x10, 0x00, 0x01, };
600 void *dns_state = NULL;
608 memset(&f, 0,
sizeof(
Flow));
611 "192.168.1.5",
"192.168.1.1",
616 f.
proto = IPPROTO_UDP;
630 "(msg:\"Test dns_query option\"; "
631 "dns_query; content:\"google\"; nocase; "
632 "pcre:\"/google\\.com$/i\"; sid:1;)");
635 "(msg:\"Test dns_query option\"; "
636 "dns_query; content:\"google\"; nocase; "
637 "pcre:\"/^\\.[a-z]{2,3}$/iR\"; sid:2;)");
644 STREAM_TOSERVER, buf,
sizeof(buf));
646 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
657 printf(
"sig 1 didn't alert, but it should have: ");
661 printf(
"sig 2 didn't alert, but it should have: ");
681 static int DetectDnsQueryTest05(
void)
684 uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
685 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
686 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
687 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
688 0x00, 0x01, 0x00, 0x01, };
690 uint8_t buf2[] = { 0x10, 0x32,
694 0x00, 0x00, 0x00, 0x00,
696 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
697 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
698 0x00, 0x01, 0x00, 0x01,
701 0x00, 0x01, 0x00, 0x01,
702 0x00, 0x01, 0x40, 0xef,
704 0x01, 0x02, 0x03, 0x04 };
707 uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
708 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
709 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
710 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
711 0x00, 0x10, 0x00, 0x01, };
713 void *dns_state = NULL;
714 Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
721 memset(&f, 0,
sizeof(
Flow));
724 "192.168.1.5",
"192.168.1.1",
727 "192.168.1.5",
"192.168.1.1",
730 "192.168.1.5",
"192.168.1.1",
735 f.
proto = IPPROTO_UDP;
760 "(msg:\"Test dns_query option\"; "
761 "dns_query; content:\"google.com\"; nocase; sid:1;)");
764 "(msg:\"Test dns_query option\"; "
765 "dns_query; content:\"google.net\"; nocase; sid:2;)");
768 "(msg:\"Test Z flag event\"; "
769 "app-layer-event:dns.z_flag_set; sid:3;)");
776 STREAM_TOSERVER, buf1,
sizeof(buf1));
778 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
789 printf(
"(p1) sig 1 didn't alert, but it should have: ");
793 printf(
"(p1) sig 2 did alert, but it should not have: ");
800 printf(
"toserver client 1 returned %" PRId32
", expected 0\n", r);
808 printf(
"(p2) sig 1 alerted, but it should not have: ");
812 printf(
"(p2) sig 2 alerted, but it should not have: ");
816 printf(
"(p2) sig 3 didn't alert, but it should have: ");
823 printf(
"toserver chunk 3 returned %" PRId32
", expected 0: ", r);
831 printf(
"(p3) sig 1 alerted, but it should not have: ");
835 printf(
"(p3) sig 2 didn't alert, but it should have: ");
861 static void DetectDnsQueryRegisterTests(
void)
865 UtRegisterTest(
"DetectDnsQueryTest03 -- tcp", DetectDnsQueryTest03);
866 UtRegisterTest(
"DetectDnsQueryTest04 -- pcre", DetectDnsQueryTest04);
867 UtRegisterTest(
"DetectDnsQueryTest05 -- app layer event", DetectDnsQueryTest05);